Single Audit of Federal Financial Assistance Programs for Fiscal Year 2014 - 2015

Home

County of Hawai‘i, State of Hawai‘i SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Fiscal year Ended June 30, 2015 SECTION II - FINANCIAL STATEMENT FINDINGS (Continued) Ref. No.Internal Control Findings 2015-002 Physical Security Condition: At June 30, 2015, the servers for the Eden and IAS systems were located in a room at the Civil Defense Center (Center). During our visit to the Center, we noted the following conditions: Security over the servers is compromised as the door to the room housing these servers is left open due to cooling concerns. Anyone with access to the Civil Defense Center could potentially access the server room. A fire suppression system was not installed. Criteria: Physical access to servers and other sensitive areas is appropriately restricted to authorized personnel. Devices are used to secure sensitive equipment and storage media from the risk of damage from fire. Cause: The County has not formally documented policies and procedures over the physical security of IT systems at the Center nor effectively designed these controls. Effect: Unauthorized access to the server room could result in unauthorized use, modification, damage or loss of data. The absence of a fire suppression system could increase the likelihood of the loss or destruction of data due to fire. Recommendation We recommend that the County develop formal policies over the physical security of IT systems at the Center and to implement them. The server room should be locked and access to keys or codes should be limited to authorized personnel. A fire suppression system should be installed to prevent or limit the loss of data from fire. SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS No matters reported. 28